OXFORD UNIVERSITY PRESS LTD JOURNAL 00 (0000), 1–17
doi:10.1093/OUP Journal/XXX000
Toward a Generalization of the Gross-Zagier Conjecture
William Stein1∗
1 Department
of Mathematics, University of Washington, Web: http: // wstein. org , Email: [email protected]
Abstract: We review some of Kolyvagin’s results and conjectures about elliptic curves, then make a new conjecture
that slightly refines Kolyvagin’s conjectures. We introduce a definition of finite index subgroups Wp ⊂ E(K), one for
each prime p that is inert in a fixed imaginary quadratic field K. These subgroups generalize the group ZyK generated
by the Heegner point yK ∈ E(K) in the case ran = 1. For any curve with ran ≥ 1, we give a description of Wp , which is
conditional on truth of the Birch and Swinnerton-Dyer conjecture and our conjectural refinement of Kolyvagin’s
conjecture. We then deduce the following conditional theorem, up to an explicit finite set of primes: (a) the set of
indexes [E(K) : Wp ] is finite, and (b) the subgroups Wp with [E(K) : Wp ] maximal satisfy a higher-rank generalization
of the Gross-Zagier formula. We also investigate a higher-rank generalization of a conjecture of Gross-Zagier.
KEY WORDS
number theory; Birch and Swinnerton-Dyer Conjecture; Euler systems; Heegner points; Kolyvagin’s conjecture;
computational number theory; Gross-Zagier theorem
Received
1
Introduction
Let E be an elliptic curve defined over Q. The order of vanishing ran at s = 1 of the Hasse-Weil L-series
L(E/Q, s) of E is defined because E is modular (see [BCDT01, Wil95]). The Birch and Swinnerton-Dyer (BSD)
rank conjecture [Bir65] asserts that ran is equal to the algebraic rank ralg of E(Q). The BSD formula then gives
a conjectural formula for the leading coefficient of the Taylor expansion about s = 1 of L(E/Q, s); this formula
resembles the analytic class number formula. The BSD rank conjecture is known for curves with ran ≤ 1, but
there has been relatively little progress toward the BSD rank conjecture when ran ≥ 2.
In the late 1980s, Kolyvagin wrote several landmark papers that combined the Gross-Zagier theorem [GZ86]
about heights of Heegner points over quadratic imaginary fields K, a theorem [BFH90] about nonvanishing of
special values of twists of L-functions, and relations involving Hecke operators between Heegner points over ring
class fields of K to prove that if ran ≤ 1, then the BSD rank conjecture is true for E. Kolyvagin wrote [Kol91a]
on the case of general rank, in which he computes the elementary invariants of the Selmer groups of any elliptic
curve E of any rank in terms of properties of Heegner points, assuming a certain nontriviality hypothesis. It was
until recently unclear whether or not this hypothesis was ever satisfied for any curve with ran ≥ 2. Fortunately,
this hypothesis has now been confirmed numerically (with high probability) in one case of a rank 2 curve [JLS08].
We review some of Kolyvagin’s results and conjectures from [Kol91a], then make a new conjecture that
refines Kolyvagin’s conjectures. Using reduction modulo p of Heegner points, we introduce a definition of finite
index subgroups Wp ⊂ E(K), one for each prime p that is inert in K. Let yK ∈ E(K) be the associated Heegner
point as in Equation (1) below. Then these subgroups Wp generalize the group ZyK in the case ran = 1. For any
ran ≥ 1, we give a description of Wp , which is conditional on truth of the BSD conjecture and our conjectural
refinement of Kolyvagin’s conjecture. We then deduce the following conditional theorem (see Theorems 7.5 and
7.7), up to an explicit finite set of primes: (a) the set of indexes [E(K) : Wp ] is finite, and (b) the subgroups Wp
with [E(K) : Wp ] maximal satisfy a higher-rank generalization of the Gross-Zagier formula (see (5) below). We
also give numerical data and a new conjecture about the existence of Gross-Zagier subgroups.
We leave open far more questions than we answer, and we intend to follow up on these questions in
subsequent papers. For example, perhaps the definition of the groups Wp can be refined and generalized in
various ways, and results similar to those in this paper proved about them. It would be interesting to find a
practical algorithm that can provably compute the groups Wp for a particular p, assuming that E(K) has already
been computed. We also hope to find a higher-rank analogue of the Gross-Zagier formula over the Hilbert class
field of K, involving the Petersson inner product, modular forms, and Rankin-Selberg convolutions LA (f, s), as
in [GZ86], which is consistent with the results we prove about the groups Wp in this paper. It would also be
∗ Supported
by NSF grant 0555776.
c 0000 Oxford University Press
Copyright Prepared using oupau.cls [Version: 2007/02/05 v1.00]
2
W.A. STEIN
valuable to give proofs of the results of [Kol91a] building on [McC91] instead of [Kol91b], possibly using results
from the present paper.
We briefly outline the structure of this paper. In the first few sections, we state the BSD conjecture and
Gross-Zagier formula, define Kolyvagin points, state Kolyvagin’s conjectures, and then define certain finite index
subgroups Wp of E(K). In the rest of the paper, we study reduction mod p, conditionally deduce the structure
of Wp , and give some numerical examples.
More precisely, we do the following. In Section 2 we state the full Birch and Swinnerton-Dyer conjecture
over an imaginary quadratic field K, and state a generalized Gross-Zagier formula for elliptic curves of any
rank. In Section 3, we introduce the Kolyvagin points Pλ on E over ring class fields of K, and deduce some key
properities of these points. We state Kolvagin’s conjectures from [Kol91a] along with some of their consequences
in Section 4. We also state a conjecture that refines Kolyvagin’s conjectures and also refines a conjecture of
Gross-Zagier. In Section 5 we use reductions of Kolyvagin points to define, for every prime p that is inert in K,
a finite index subgroup Wp of E(K). Section 6 lays some general foundations for our later determination of the
structure of Wp by studying the image of a fixed Q ∈ E(K) in E(Fp2 )/(p + 1). Section 7 presents a conditional
proof that (up to primes not in the set B(E)) maximal index subgroups exist and that they satisfy our generalized
Gross-Zagier formula. Finally, in Section 8 we numerically investigate the existence of Gross-Zagier subgroups
of E(K), and give evidence for a higher-rank generalization of a conjecture of Gross-Zagier.
Acknowledgement: We thank R. Bradshaw, K. Buzzard, C. Citro, J. Coates, C. Cornut, M. Flach, R.
Greenberg, B. Gross, D. Jetchev, K. Lauter, B. Mazur, R. Miller, and Tonghai Yang for helpful conversations.
We thank Amod Agashe and Andrei Jorza for carefully reading a draft of the paper and providing many helpful
comments, and we thank the anonymous referee for much helpful feedback.
“It is always good to try to prove true theorems.”
– Bryan Birch
1.1
Notation and Conventions
Let A be an abelian group. Let Ator be the subgroup of elements of A of finite order and let A/ tor = A/Ator
denote the quotient of A by its torsion subgroup. Let A[n] be the subgroup of elements of A of order n, and for
any prime `, let A(`) be the subgroup of elements of `-power order. For z ∈ A, let e = ord` (z) be the largest
integer e such that z = `e y for some y ∈ A, or ord` (z) = ∞ if the set of e is unbounded. If a1 , . . . , an are elements
of an additive or multiplicative group A, we let ha1 , . . . , an i denote the subgroup of A generated by the ai .
Throughout this paper, E denotes an elliptic curve defined over Q of conductor N , and K is a quadratic
imaginary field with D = disc(K) coprime to N that satisfies the Heegner hypothesis—each prime dividing N
splits in K. We fix an ideal N in OK such that OK /N is cyclic of order N . Let H be the Hilbert class field of
K, let π : X0 (N ) → E be a fixed choice of modular parametrization (see Section 3 below), and let
yK = TrH/K (π((C/OK , N −1 /OK ))) ∈ E(K)
(1)
be the Heegner point associated to K.
Let c denote the Manin constant of E (see Section 2), and cq the Tamagawa numbers of E at primes q | N .
Unless otherwise stated, everywhere in this paper p denotes a prime that is inert in K.
2
Gross-Zagier Subgroups
In this section, we fix our notation and conventions, and define the Manin constant. Then we recall the statement
of the full Birch and Swinnerton-Dyer conjecture over an imaginary quadratic field K. We give a new definition
of Gross-Zagier subgroups of E(K) and prove that they all satisfy a Gross-Zagier style formula. When ran = 1,
we prove that ZyK is the unique Gross-Zagier subgroup, up to torsion.
Let E be an elliptic curve over Q and let K be a quadratic imaginary field that satisfies the Heegner
hypothesis – so K has discriminant D < −4, each prime dividing the conductor N of E splits in K, and
gcd(D, N ) = 1. Let OK be the ring of integers of K. Let E D denote the quadratic twist of E by D. Throughout
this paper, except briefly in Section 8, we always assume that
ran (E/Q) > ran (E D /Q) ≤ 1
Recall that under the Heegner hypothesis the sign of the functional equation of
L(E/K, s) = L(E/Q, s) · L(E D /Q, s)
(2)
TOWARD A GENERALIZATION OF THE GROSS-ZAGIER CONJECTURE
3
is −1, so the sign in the functional equations for L(E/Q, s) and L(E D /Q, s) are different, hence
ords=1 L(E/Q, s) 6≡ ords=1 L(E D /Q, s)
(mod 2).
Proposition 2.1. Suppose E is an elliptic curve with ran (E/Q) > 0. Then there exist infinitely many D
satisfying the Heegner hypothesis with
ran (E/Q) > ran (E D /Q) ≤ 1.
Proof. The main theorem of [BFH90] implies the existence of infinitely many D with ran (E D /Q) ≤ 1. Since
ran (E/Q) > 0 and ran (E/Q) 6≡ ran (E D /Q) (mod 2), the inequality ran (E/Q) > ran (E D /Q) also holds.
Let ω = 2πicf (z)dz be the pullback of a minimal invariant differential on E, where f (z) ∈ S2 (Γ0 (N )) is a
cuspidal newform, and c is the Manin constant of E (see [ARS06]). For each prime q | N , let cq be the Tamagawa
number of E at q. SetR r = ran (E/K) = ords=1 L(E/K, s), which is defined since every elliptic curve over Q is
modular. Let kωk2 = E(C) ω ∧ iω = 2 · Vol(C/Λ). The Shafarevich-Tate group of E over a number field M is
!
M
1
1
X(E/M ) = ker H (M, E) →
H (Mv , E) .
v
The following is a formulation of the Birch and Swinnerton-Dyer conjecture [GZ86, pg. 311] over K.
Conjecture 2.2 (Birch and Swinnerton-Dyer). The Mordell-Weil group E(K) has rank r = ords=1 L(E/K, s),
the Shafarevich-Tate group X(E/K) is finite, and
Q
2
#X(E/K) · kωk2 · Reg(E/K) ·
q|N cq
L(r) (E/K, 1)
p
=
.
(3)
r!
#E(K)2tor · |D|
Let Xan be the order of X(E/K) that is predicted by Conjecture 2.2. The existence of the Cassels-Tate
pairing
implies that if X(E/K) is finite, then #X(E/K) is a perfect square, so Conjecture 2.2 implies that
√
Xan is an integer. Recall from Section 1.1 that A/ tor = A/Ator .
Definition 2.3 (Gross-Zagier subgroup). A Gross-Zagier subgroup W ⊂ E(K) is a torsion-free subgroup such
that E D (Q) ⊂ W + E(K)tor , the quotient E(K)/ tor /W is cyclic, and
Y
p
(4)
[E(K) : W ] = c ·
cq · Xan .
For any set S of primes, we say that a subgroup W ⊂ E(K) is a Gross-Zagier subgroup up to primes not
in S if W has no p-torsion for p 6∈ S and all the conditions of Definition 2.3 holds up to primes not in S.
We will numerically investigate the existence of Gross-Zagier subgroups in Section 8, assuming that
Conjecture 2.2 is true. Even the existence
of
√ Gross-Zagier subgroups of every E(K) is far from clear, since
Q
if they exist, then #E(K)tor divides c cq · Xan . In fact, we will give an example of an E(K) that does not
have any Gross-Zagier subgroups (this example does not satisfy (2)).
In the following proposition we do not assume the Conjecture 2.2. Thus Xan a priori could just be some
meaningless transcendental number. Also, for any subgroup H ⊂ E(K), we write Reg(H) for the absolute value
of the determinant of the height pairing matrix on any basis for H modulo torsion.
Proposition 2.4. If W is a Gross-Zagier subgroup, then W satisfies the generalized Gross-Zagier formula:
kωk2
L(r) (E/K, 1)
p
=
· Reg(W ).
r!
c2 · |D|
(5)
More generally,Qa torsion-free
subgroup W ⊂ E(K) satisfies the generalized Gross-Zagier formula if and only if
√
it has index c · cq · Xan in E(K).
Proof. The BSD formula (3) with #X(E/K) replaced by Xan implies that (5) holds if and only if
Q
2
2
X
·
kωk
·
Reg(E/K)
·
c
2
an
p|N q
kωk
p
p
· Reg(W ) =
.
2
2
c · |D|
#E(K)tor · |D|
(6)
Our hypotheses that [E(K) : W ] is finite and that W is torsion free imply that
[E(K) : W ]2 =
Reg(W ) · #E(K)2tor
Reg(E/K)
(7)
Manipulate (6) by cancelling everything in common on both sides and putting the regulators and torsion on the
Q
2
left, and everything else on the right. The substitution (7) then shows that [E(K) : W ]2 = c2 ·
c
· Xan
q
q|N
if and only if (5) holds. Taking square roots proves the proposition.
4
W.A. STEIN
Corollary 2.5. Let yK ∈ E(K) be the Heegner point after fixing a choice of ideal N as in Equation (1), and
assume that E has analytic rank 1. Then the Gross-Zagier subgroups of E(K) are the cyclic groups hyK + P i,
for all P ∈ E(K)tor .
Proof. By [Kol88], E(K) is of rank
and by Proposition 2.4 the Gross-Zagier formula [GZ86, Thm. 2.1,
Q 1, √
pg. 311] implies that [E(K) : hyK i] = c cq Xan (see also, [GZ86, Conj. 2.2, pg. 311]). Since E(K)/ tor is free of
rank 1 and hyK i is torsion free, E(K)/ tor /hyK i is cyclic, so hyK i is a Gross-Zagier subgroup. The same argument
proves this with yK replaced by yK + P for any P ∈ E(K)tor , since yK and yK + P have the same height.
If W is any Gross-Zagier subgroup, then since E(K) has rank one we must have W ≡ hyK i (mod E(K)tor ), so
W = hyK + P i for some P ∈ E(K)tor .
3
Heegner and Kolyvagin Points
In this section, we define certain subsets Λk`n ⊂ Z of positive square-free integers. For each integer λ ∈ Λk`n , we
consider the corresponding ring class field Kλ , and we define elements Iλ , Jλ ∈ Z[Gal(Kλ /K)]. We then apply
these group ring elements to the Heegner points yλ ∈ E(Kλ ) to obtain the Kolyvagin points Pλ ∈ E(Kλ ). Finally,
we prove the Gal(Kλ /K)-equivariance of the equivalence class Pλ + `n E(K) in P
E(K)/`n E(K).
For any integer m, let am = am (E) be the mth coefficient of the L-series
am /ms attached to E. Let `
k
be any prime and n any positive integer. For any nonnegative integer k, let Λ`n be the set of squarefree positive
integers λ = p1 . . . pk coprime to N , where each pi is inert in K and
(mod `n ).
api ≡ pi + 1 ≡ 0
When k = 0, we set Λ0`n = {1}. The Chebotarev density theorem implies that Λk`n is infinite for any k ≥ 1.
Recall from Section 1.1 that we fixed an ideal N in OK such that OK /N is cyclic of order N , and let
Oλ = Z + λOK be the order in OK of conductor λ. Let X0 (N ) be the compact modular curve defined over Q
that classifies isomorphism classes of elliptic curves equipped with a cyclic subgroup of order N . Fix a choice of
minimal modular parametrization π : X0 (N ) → E, which exists by the modularity theorem [BCDT01, Wil95].
For each λ ∈ Λk`n , the Heegner point
xλ = [(C/Oλ , (N ∩ Oλ )−1 /Oλ )] ∈ X0 (N )(Kλ )
is defined over the ring class field Kλ of K of conductor λ.
Definition 3.1 (Heegner point). The Heegner point yλ associated to λ ∈ Λk`n is
yλ = π(xλ ) ∈ E(Kλ ).
We emphasize that that yλ depends on the choice of modular parametrization πE and the ideal N in OK
with OK /N = Z/N Z. However, once we fix that data, the Heegner points for all λ are defined.
For λ ∈ Λk`n , let Gλ = Gal(Kλ /K1 ) and note that we have a canonical isomorphism
Gλ ∼
=
Y
Gp ,
p|λ
where the group Gp = Gal(Kp /K1 ) = htp i is cyclic of order p + 1, with some (non-canonical) choice tp of
generator. Let
p
X
Y
Ip =
itip ∈ Z[Gp ] and Iλ =
Ip ∈ Z[Gλ ].
i=1
p|λ
Let R be a set of representatives in Gal(Kλ /K) for the quotient group Gal(Kλ /K)/ Gal(Kλ /K1 ) ∼
= Gal(K1 /K),
and let
X
Jλ =
g ∈ Z[Gλ ].
g∈R
Definition 3.2 (Kolyvagin Point). The Kolyvagin point Pλ associated to λ ∈ Λk`n is
Pλ = Jλ Iλ yλ ∈ E(Kλ ).
TOWARD A GENERALIZATION OF THE GROSS-ZAGIER CONJECTURE
5
Note that P1 = yK ∈ E(K).
Let R = End(E/C) and let B(E) be the set of odd primes ` that do not divide disc(R) and such
that the `-adic representation Gal(Q/Q) → AutR (Tate` (E)) is surjective. By a theorem of Serre [Ser72], the
set B(E) contains all but finitely many primes (see [GJP+ 09] for algorithms to bound B(E)). Let Tp be
the pth Hecke operator on the Jacobian J0 (N ) of X0 (N ), and for each prime p | λ, let Trp be the trace
J0 (N )(Kλ ) → J0 (N )(Kλ/p ).
Proposition 3.3. The points yλ form an Euler system, in the sense that if λ = pλ0 for a prime p and λ ∈ Λ` ,
then yλ = Frob℘ (yλ0 ) (mod ℘) for all primes ℘ of Kλ over p, and Trp (xλ ) = Tp (xλ0 ) in J0 (N ).
Proof. See [Gro91, Prop. 3.7].
Proposition 3.4. We have
[Iλ yλ ] ∈ (E(Kλ )/`n E(Kλ ))Gλ
[Pλ ] ∈ (E(Kλ )/`n E(Kλ ))Gal(Kλ /K)
and
Proof. Though standard (see, e.g., [Gro91, Prop. 3.6]) this proposition plays a key role in Section 5, so we
give a proof here for the convenience of the reader. The first statement implies the second, since [Pλ ] is the
Gal(K1 /K) trace of [Iλ yλ ]. It remains to prove the first inclusion. For this, it suffices to show that [Iλ yλ ] is fixed
by tp for all primes p | λ, as these elements generate Gλ . We will prove this by showing that (tp − 1)Iλ yλ lies in
`n E(Kλ ).
Write λ = pλ0 . We have
!
p
X
i
(8)
itp = p + 1 − Trp ,
(tp − 1)Ip = (tp − 1) ·
i=1
where asP
above Trp = TrKλ /Kλ0 . Note that this is the only place in the proof where we use the explicit definition
p
of Ip as i=1 itip , and in fact we could instead replace Ip by any element I of Z[Gλ ] such that
(tp − 1)I = p + 1 − Trp ,
but doing so does not seem to lead to anything interesting. Note that the Euler system relation (see
Proposition 3.3) and our hypothesis that ap ≡ 0 (mod `n ) together imply that
Trp Iλ0 yλ = Iλ0 Trp yλ = Iλ0 ap yλ0 ∈ `n E(Kλ ).
We have
(tp − 1)Iλ = (tp − 1)Ip Iλ0 = (p + 1 − Trp )Iλ0
in Z[Gλ ], so since p + 1 ≡ 0 (mod `n )
(tp − 1)Iλ yλ = (p + 1)Iλ0 yλ − Trp Iλ0 yλ ∈ `n E(Kλ ).
4
Kolyvagin’s Conjectures and their Consequences
For any prime ` and positive integer n, let
Λ`n =
[
Λk`n
all k≥0
be the set of square-free positive integers λ such that `n | gcd(ap , p + 1) for each p | λ. In this section, we define
maps n, m : Λ` → Z ∪ {∞} that measure `-divisibility properties of λ and Pλ for all λ ∈ Λ` . We state Kolyvagin’s
“Conjecture A” that there exists λ with m(λ) 6= ∞, then state Kolyvagin’s structure theorem, which describes
b
the structure of Sel(` ) (E/K), for b sufficiently large, in terms of the maps n and m. Finally, we state Kolyvagin’s
stronger “Conjecture D”, which basically asserts that if f is the smallest nonnegative integer such that m(λ) 6= ∞
for some λ ∈ Λf` , then for sufficiently large k the cohomology classes τλ,`n with λ ∈ Λf`n +k generate a subgroup
n
of Sel(` ) (E/K) that equals the image of a subgroup V of E(K). To motivate Conjecture 4.9, we prove that it
implies that rank(E(Q)) = f + 1 and X(E/K)(`) is finite for each ` ∈ B(E) and determine the structure of V
(see Proposition 4.11).
6
W.A. STEIN
Recall that we defined ord` in Section 1.1. Define two set-theoretic maps
n, m : Λ` → Z ∪ {∞}
by
n(λ) = max{e : λ ∈ Λ`e }
and
m(λ) = ord` ([Pλ ]),
where [Pλ ] denotes the equivalence class of Pλ in E(Kλ )/`n(λ) E(Kλ ). For each integer k ≥ 0, let
m`,k = min(m(Λk` ))
and
m` = min(m(Λ` )) = min({m`,k : k ≥ 0}).
Also, let
f` = min{k : m`,k < ∞} ≤ ∞,
(9)
where we let f` = ∞ if m` = ∞.
Kolyvagin proves [Kol91b, Thm. C] that m`,0 ≥ m`,1 ≥ m`,2 ≥ . . . .
Conjecture 4.1 (Kolyvagin’s Conjecture A` ). m` < ∞. Equivalently, there exists λ ∈ Λ` such that [Pλ ] 6= 0.
See [JLS08] for the first computational evidence for Conjecture 4.1. For example, for a specific rank 2 elliptic
curve, that paper shows that m3 = m3,1 = 0 and f3 = 1, assuming that the numerical computation of a certain
Heegner point yλ was done to sufficient precision. (If the computation were not done to sufficient precision it is
highly likely that we would haved detected this.)
Conjecture 4.1 is quite powerful, as the following theorem shows. For an abelian group A of odd order
with an action of complex conjugation, let A+ denote the +1 eigenspace for conjugation and A− the minus
eigenspace, so A = A+ ⊕ A− . As always, we continue to assume our minimality hypothesis that
ran (E/Q) > ran (E D /Q) ≤ 1.
Theorem 4.2 (Kolyvagin). Let ` ∈ B(E), suppose Conjecture 4.1 is true for `, and let f = f` . For every k, let
bk = `m`,k −m`,k+1 . Then for every n ≥ m`,f , we have
n
n
Sel(` ) (E/Q) = Sel(` ) (E/K)+ ≈ (Z/`n Z)f +1 ⊕ (Z/bf +1 Z)2 ⊕ (Z/bf +3 Z)2 ⊕ · · ·
and
n
n
Sel(` ) (E D /Q) = Sel(` ) (E/K)− ≈ (Z/`n Z)h ⊕ (Z/bf Z)2 ⊕ (Z/bf +2 Z)2 ⊕ · · ·
where h = rank(E D (Q)) ≤ 1.
Proof. The leftmost equality in the above two equations is true because ` is odd, and Theorem 1 of [Kol91a]
n
n
implies both of the rightmost equalities, but possibly with Sel(` ) (E/K)+ and Sel(` ) (E/K)− swapped and a
different value for h. Theorem 1 of [Kol91a] is proved by inductively constructing cohomology classes with good
properties with respect to certain localization homomorphisms. To finish the proof, we establish that these two
Selmer groups are not swapped and that h = rank(E D (Q)).
First note that by [Kol88, BFH90], our hypothesis that ran (E D /Q) ≤ 1 implies that ran (E D /Q) =
rank(E D (Q)) and X(E D /Q) is finite.
If f = 0, then the Heegner point yK has infinite order, so by [GZ86] we have ran (E/K) = 1 and by [Kol88],
E(K) has rank 1 and X(E/K) is finite. By our minimality hypothesis, we have ran (E/Q) > ran (E D /Q),
so ran (E/Q) = rank(E(Q)) = 1 and ran (E D /Q) = rank(E D (Q)) = 0. Thus the two displayed Selmer groups
n
Sel(` ) (E/K)± are in the claimed order. Moreover, h = 0 = rank(E D (Q)).
Next assume f > 0. Then one of the two Selmer groups contained (Z/`n Z)f +1 for arbitrarily large n.
Since we know that X(E D /Q) is finite and rank(E D (Q)) ≤ 1 but f + 1 ≥ 2, the Selmer group that contains
n
(Z/`n Z)f +1 must be Sel(` ) (E/K)+ . Thus again we see that the two displayed Selmer groups are in the claimed
order. Also, again h = rank(E D (Q)) follows.
Remark 4.3. Suppose the hypotheses of Theorem 4.2 are satisfied. Then comparing the conclusion about the
choice of signs in Theorem 4.2 with the statement of Theorem 1 in [Kol91a] shows that f + 1 ≡ ran (E/Q)
(mod 2), which implies the parity conjecture for the Selmer group of E at `.
Proposition 4.4. Let ` ∈ B(E). Then f` = rank(E(Q)) − 1 if and only if X(E/Q)(`) is finite and Conjecture 4.1 holds for `.
TOWARD A GENERALIZATION OF THE GROSS-ZAGIER CONJECTURE
7
Proof. First suppose f` = rank(E(Q)) − 1. Then f` 6= ∞, so Conjecture 4.1 holds. To prove that X(E/Q)(`)
n
is finite, use Theorem 4.2 and that by our rank hypothesis the image of E(Q) in Sel(` ) (E/Q) is (Z/`n Z)f +1 .
Thus X(E/Q)[`n ] is a quotient of the `n -torsion subgroup of the finite group (Z/bf +1 Z)2 ⊕ (Z/bf +3 Z)2 ⊕ · · · ,
so X(E/Q)(`) is finite.
Conversely, suppose the `-primary group X(E/Q)(`) is finite and that Conjecture 4.1 holds. Let b
b
be a positive integer such that `b X(E/Q)(`) = 0. Then the map Sel(` ) (E/Q) → X(E/Q)(`) is surjective,
n
b
and for every integer n ≥ b, the map Sel(` ) (E/Q)[`b ] → X(E/Q)(`) is also surjective, since Sel(` ) (E/Q) →
n
n
Sel(` ) (E/Q)[`b ]. The image of `b Sel(` ) (E/Q) in X(E/Q)(`) is trivial. Since ` ∈ B(E) we have E(Q)tor [`] = 0,
so exactness of the sequence
n
0 → E(Q)/`n E(Q) → Sel(` ) (E/Q) → X(E/Q)(`) → 0
n
implies that `b Sel(` ) (E/Q) ≈ `b (Z/`n Z)r , where r = rank(E(Q)). On the other hand, if we also choose
n
`b ≥ bf +1 , then Theorem 4.2 implies that `b Sel(` ) (E/Q) ≈ `b (Z/`n Z)f +1 . We conclude that r = f + 1.
Kolyvagin’s other conjectures involve H1 (K, E[`∞ ]) = lim H1 (K, E[`m ]).
−m
→
Lemma 4.5. Suppose E(K)[`] = 0. Then for every m ≥ 1, the natural map H1 (K, E[`m ]) → H1 (K, E[`∞ ]) is
injective.
Proof. This lemma is of course very well known, but we give a proof for completeness. It suffices to show
that for any pair a, b of nonnegative integers that the map
H1 (K, E[`a ]) → H1 (K, E[`a+b ])
is injective. Taking Galois cohomology of 0 → E[`a ] → E[`a+b ] → E[`a+b ]/E[`a ] → 0 we see
H0 (K, E[`a+b ]/E[`a ]) surjects onto the kernel of (10). We have an exact sequence of Galois modules
(10)
that
`a
0 → E[`a ] → E[`a+b ] −→ E[`b ] → 0,
so H0 (K, E[`a+b ]/E[`a ]) ∼
= H0 (K, E[`b ]) = E(K)[`b ] = 0, since E(K)[`] = 0.
We now define Galois cohomology classes associated to the Kolyvagin points Pλ . For λ ∈ Λ`n with ` ∈ B(E),
let τλ,`n ∈ H1 (K, E[`n ]) be the image of Pλ under the map
(E(Kλ )/`n E(Kλ ))Gal(Kλ /K) ,→ H1 (Kλ , E[`n ])Gal(Kλ /K) ∼
= H1 (K, E[`n ]),
where the last map is an isomorphism because ` ∈ B(E) (see, e.g., [Gro91, §4]). Kolyvagin also remarks that one
can define Galois cohomology classes τλ,`n for ` 6∈ B(E) and all λ ∈ Λ`k0 +n , where k0 is the smallest nonnegative
even integer such that `k0 /2 E(K)(`) = 0 and K is the compositum of all Kλ for λ ∈ Λ. Of course, for all ` ∈ B(E)
we have k0 = 0.
0
1
∞
Let τλ,`
]) of τλ,`n (note that for the moment we are not assuming that
n be the image in H (K, E[`
1
m
` ∈ B(E), so the natural map H (K, E[` ]) → H1 (K, E[`∞ ]) need not be injective). For any integers a ≥ 0,
k ≥ k0 and n ≥ 1, let
a
0
a
1
∞
Vk,`
])
n = hτλ,`n : λ ∈ Λ`n+k i ⊂ H (K, E[`
Since Λa`n+k+1 ⊂ Λa`n+k , we have
a
a
a
V0,`
n ⊃ V1,`n ⊃ V2,`n ⊃ · · · .
We have `τλ,`n+1 = τλ,`n , because the following diagram commutes, with G = Gal(Kλ /K):
(E(Kλ )/`k+n+1 E(Kλ ))G
O

/ H1 (Kλ , E[`k+n+1 ])G
O
[`]
(E(Kλ )/`k+n E(Kλ ))G
a
a
Thus `Vk,`
n+1 ⊂ Vk,`n .

/ H1 (Kλ , E[`k+n ])G
8
W.A. STEIN
We say {τλ,`n } is a strong nonzero system if there exists a ≥ 0 such that for all k ≥ k0 there exists n such
1
a
∞
that Vk,`
]) below infinitely far to the
n 6= 0. In other words, if one continues the grid of subgroups of H (K, E[`
right and up in the obvious way, then it is not the case that sufficiently far to the right every single group is 0.
..
.
..
.
..
.
a
V0,`
3 o
a
V1,`
3 o
a
V2,`
3 o
···
a
V0,`
2 o
a
V1,`
2 o
a
V2,`
2 o
···
a o
V0,`
a o
V1,`
a o
V2,`
···
Conjecture 4.6 (Kolyvagin’s Conjecture B` ). {τλ,`n } is a strong nonzero system.
Remark 4.7. Kolyvagin remarks [Kol91a, pg. 258] that if ` ∈ B(E), then {τλ,`n } is a strong nonzero system if
a
and only if there exists n such that V0,`
n 6= 0. By Lemma 4.5, this is the case if and only if some τ is nonzero.
So for ` ∈ B(E), Conjectures 4.1 is true if and only if Conjecture 4.6 is true.
The following conjecture is motivated by Theorem 4.2 and the conjecture that X(E/K) is finite.
Conjecture 4.8 (Kolyvagin’s Conjecture C). The set of primes ` such that m` 6= 0 is finite.
Let ran = ords=1 L(E, s), and let ε = (−1)ran −1 . For any module A with an action of complex conjugation
σ, and ν ∈ {0, 1}, let Aν = (1 − (−1)ν εσ)A.
Conjecture 4.9 (Kolyvagin’s Conjecture D` ). There exists ν ∈ {0, 1} and a subgroup V ⊂ (E(K)/E(K)tor )ν
such that 1 ≤ rank(V ) ≡ ν (mod 2) and for all n ≥ 1 and all sufficiently large k, one has
a
Vk,`
n ≡ V
(mod `n (E(K)/ tor )),
where a = rank(V ) − 1.
The following conjecture is the natural generalization to higher rank of the hypothesis when ran (E/Q) = 1
that the Hegner point yK has infinite order.
Conjecture 4.10 (Kolyvagin’s Conjecture D). There exists a single subgroup V of E(K) such that Conjecture 4.9 holds simultaneously for all ` with that V .
Conjecture 4.9 has numerous consequences. Much of the following proposition is implicitly stated without
any proofs in [Kol91a, pg. 258–259], so we give complete proofs below.
Proposition 4.11. Assume our running minimality hypothesis that ran (E/Q) > ran (E D /Q) ≤ 1. Suppose
Conjecture 4.9 is true for ` ∈ B(E) and let f = f` . Then
1.
2.
3.
4.
5.
6.
(E(K)/E(K)tor )ν = (E(K)/E(K)tor )+ ,
a = f,
rank(E(Q)) = f + 1,
X(E/K)(`) is finite,
ran (E/Q) ≡ rank(E(Q)) (mod 2), and
V ⊗ Z` = `mf E(Q) ⊗ Z` .
Proof. By Conjecture 4.9, there exists ν ∈ {0, 1} and a subgroup V ⊂ (E(K)/E(K)tor )ν such that 1 ≤
rank(V ) ≡ ν (mod 2) and for all n > 0 and all sufficiently large k we have
a
Vk,`
n ≡ V
(mod `n E(K)tor ),
where a = rank(V ) − 1.
f
0
If rank(V ) = 1, then a = 0, so Vk,`
n 6= 0 for some k, so since f is the smallest integer such that Vk,`n 6= 0,
this implies that f = 0 giving Part 2; thus the Heegner point yK has infinite order and ran (E/K) = 1. Since
ran (E/Q) > ran (E D /Q), we have ran (E/Q) = 1 and ran (E D /Q) = 0, so Parts 1,3,4, 5 follows. Finally, Part 6
0
follows since Vk,`
n is just the image of the Heegner point yK under the connecting homomorphism, and
ord` (yK ) = mf .
TOWARD A GENERALIZATION OF THE GROSS-ZAGIER CONJECTURE
9
Next assume that rank(V ) > 1. By our minimality hypothesis, ran (E D /Q) ≤ 1, so rank(E D (Q)) ≤ 1, hence
a
V 6⊂ (E(K)/E(K)tor )− , so V ⊂ (E(K)/E(K)tor )+ , which proves Part 1. We have f ≤ a since Vk,`
n 6= 0 for
some k ≥ 0. Also, since f < ∞, Theorem 4.2 implies that rank(E(Q)) ≤ f + 1. Since rank((E(K)/E(K)tor )+ ) =
rank(E(Q)), we have
a + 1 = rank(V ) ≤ rank(E(Q)) ≤ f + 1 ≤ a + 1.
We conclude that the above inequalities are equalities, so a = f which proves Part 2, and rank(E(Q)) = f + 1,
which proves Part 3. Also because rank(E(Q)) = f + 1, Theorem 4.2 implies that X(E/Q)(`) is finite, so
since X(E D /Q)) is also finite, Part 4 is true. Considering the definition of the Aν before the statement of
Conjecture 4.9, we see that 1 − (−1)ν (−1)ran −1 σ = 1 + σ, so ν ≡ ran (mod 2). Since part of Conjecture 4.9
is that rank(V ) ≡ ν (mod 2), and we proved that rank(V ) = rank(E(Q)), we conclude that ran ≡ rank(E(Q))
f
1
∞
(mod 2), which is Part 5. By [Kol91a, Thm. 3], for all k ≥ mf the subgroup Vk,`
]) contains
n ⊂ H (K, E[`
mf
n
f +1
mf
mf
(` Z/` Z)
= δ(` E(Q)), so ` E(Q) ⊗ Z` ⊂ V ⊗ Z` . On the other hand, by definition of mf , every
cohomology class τλ,`n is contained in `mf H1 (K, E[`n ]). Thus δ(V ) ⊂ `mf H1 (K, E[`∞ ]), so V ⊂ `mf E(Q). This
proves Part 6.
Recall from Section 2 that c is the Manin constant of E and the cq are the Tamagawa numbers of E. We
make the following new refinement of Kolyvagin’s Conjecture 4.8.
Q
Conjecture 4.12. We have m` = ord` (c · q|N cq ).
Theorem 7.5 and Theorem 7.7 below serve as our motivation to make Conjecture 4.12. In particular,
Kolyvagin proved that at primes ` ∈ B(E), Conjecture 4.12 is equivalent to [GZ86, Conj 2.2, pg 311] in the
special case when E has analytic rank 1 over K.
5
Mod p Kolyvagin Points and Kolyvagin Subgroups
As always, we assume E is an elliptic curve over Q, that K is a quadratic imaginary field satisfying the Heegner
hypothesis, and p is a prime that is inert in K. The Heegner hypothesis implies that the primes of bad reduction
for E split in K, so p must be a prime of good reduction. For each such prime, we define a finite-index subgroup
Wp of E(K). We do this by extending Kolyvagin’s construction of points Pλ to obtain a new well-defined
construction of elements of the quotient group
E(Fp )/(p + 1) = E(Fp )/(p + 1)E(Fp )
for any inert prime p. Thus this section takes Kolyvagin’s definition of points Pλ one step further to define
elements of E(Fp )/(p + 1). We first compute the structure of the odd part of the group E(Fp )/(p + 1) for any
good prime p. We then use properties of splitting of primes in certain ring class fields to define the canonical
reduction Rp,λ ∈ E(Fp )/(p + 1) of the Kolyvagin points Pλ , and consider the subgroup Xp of E(Fp )/(p + 1)
generated by the Rp,λ for certain λ. We then define Wp to be the inverse image of Xp and finish with some
results about the structure of Wp .
If A is a finite abelian group, the odd part of A is the subgroup of A of all elements of odd order, and if n
is an integer, the odd part of n is n/2ord2 (n) .
Lemma 5.1. The odd part of E(Fp )/(p + 1) is cyclic of order the odd part of gcd(p + 1, ap ).
Proof. Suppose ` is an odd prime divisor of #(E(Fp )/(p + 1)). If the `-primary subgroup of E(Fp )/(p + 1)
is not cyclic, then since ` 6= p we have E(Fp )[`] ≈ (Z/`Z)2 . The Weil pairing induces an isomorphism of Galois
V2
modules
E[`] ∼
= µ` and E[`] ⊂ E(Fp ), so µ` ⊂ F∗p , hence ` | (p − 1). Since ` divides #(E(Fp )/(p + 1)) and `
is prime, we have ` | (p + 1), so ` | gcd(p − 1, p + 1) = 2, a contradiction, since ` is odd.
The group E(Fp ) has order p + 1 − ap , and we just proved above that E(Fp )(`) is cyclic for any odd prime
divisor ` of p + 1. Thus the quotient `-primary group (E(Fp )/(p + 1))(`) = (E(Fp )(`))/(p + 1) has order `m ,
where
m = ord` (gcd(p + 1, #E(Fp ))) = ord` (gcd(p + 1, p + 1 − ap )) = ord` (gcd(p + 1, ap )).
Taking the product over all odd primes `, shows that the odd part of E(Fp )/(p + 1) has order the odd part of
gcd(p + 1, ap ).
10
W.A. STEIN
Remark 5.2.
1. Lemma 5.1 is true even if p is a good prime that is not inert in K (in fact, the lemma and
proof have nothing to do with K).
2. Lemma 5.1 is false if we do not restrict to odd parts. For example, if E is y 2 = x3 − x and p = 3, then
E(F3 ) ≈ (Z/2Z)2 , so E(F3 )/4 ≈ (Z/2Z)2 is not cyclic.
3. For every prime `, there exists infinitely many primes p such that E(Fp )(`) is not cyclic. Indeed, by the
Chebotarev density theorem there are infinitely many p that split completely in the field Q(E[`]), and for
these p we have (Z/`Z)2 ⊂ E(Fp ).
Lemma 5.3. If p is inert in K and does not divide λ, then the prime ideal pOK of K splits completely in Kλ .
In particular, if p ∈ Λ1`n and λ ∈ Λ`n with p - λ, then pOK splits completely in Kλ .
Proof. (Compare line −3 on page 103 of [Kol91b].) Since p is inert, the ideal pOK is a prime principal ideal
of OK , hence splits completely in the Hilbert class field K1 . As explained in [Gro91, pg. 238], class field theory
identifies Gal(Kλ /K1 ) with C = (OK /λOK )∗ /(Z/λZ)∗ . The image of p is trivial in C, so the Frobenius element
attached to pOK is trivial, hence pOK splits completely in the ring of integers of Kλ , as claimed.
Define the reduction map E(K) → E(Fp2 ) by reducing the Néron model E of E over OK modulo pOK ,
and using the natural maps E(K) ∼
= E(Fp2 ). Let πp : E(K) → E(Fp )/(p + 1) be the
= E(OK ) → EFp2 (Fp2 ) ∼
composition of reduction modulo the prime ideal pOK with TrFp2 /Fp : E(Fp2 ) → E(Fp ) followed by quotienting
out by the subgroup (p + 1)E(Fp ). Fix a choice ℘ of prime ideal of Kλ over pOK . Extend πp to a map
π℘ : E(Kλ ) → E(Fp )/(p + 1) by quotienting out by ℘, as illustrated in the following diagram:
E(Kλ ) UU
O
UUUU
UUUU mod ℘
UUUU
UUUU
UUU*
∼
= /
/ E(Fp2 )
E(K)
E(OK )
trace
E(Fp )
πp
% E(Fp )/(p + 1)
For each ` | (p + 1), let v` = ord` (gcd(ap , p + 1)), and define π℘,` : E(Kλ ) → (E(Fp )/(p + 1))(`) by
π℘,` (S) = π℘
p+1
S .
`v`
We now study how the homomorphism π℘,` depends on our choice of prime of ℘ over pOK .
Proposition 5.4. The map π℘,` induces a well-defined (independent of choice of ℘) homomorphism
ϑ : (E(Kλ )/`v` E(Kλ ))
Gal(Kλ /K)
→ E(Fp )/(p + 1).
Gal(K /K)
λ
Proof. Let [S] ∈ (E(Kλ )/`v` E(Kλ ))
with S ∈ E(Kλ ). If ℘0 is another prime of Kλ over pOK , then
because the Galois group acts transitively on the primes over a given prime, there is σ ∈ Gal(Kλ /K) such that
π℘0 ,` (S) = π℘,` (σ(S)). Since [S] is Gal(Kλ /K)-equivariant, we have σ(S) = S + `v` · Q, for some Q ∈ E(Kλ ), so
ϑ([σ(S)]) = π℘,` (σ(S))
p+1
= π℘
σ(S)
`v`
p+1
= π℘
S + π℘ ((p + 1)Q)
`v`
= π℘,` (S) + 0 = ϑ([S]),
where π℘ ((p + 1)Q) = (p + 1)π℘ (Q) is 0, since the group E(Fp )/(p + 1) is killed by p + 1.
TOWARD A GENERALIZATION OF THE GROSS-ZAGIER CONJECTURE
11
By Proposition 3.4, [Pλ ] is in the domain of the homomorphism ϑ of Proposition 5.4.
Definition 5.5 (Mod p Kolyvagin Point). The mod p Kolyvagin point associated to p ∈ Λ1`n and λ ∈ Λ`n is
Rp,λ = ϑ([Pλ ]) ∈ E(Fp )/(p + 1),
where ϑ is as in Proposition 5.4.
As above, let v` = ord` (gcd(ap , p + 1)). For each k ≥ 0, let
*
+
[ f
Xk,p = Rp,λ : λ ∈
Λ`v`` +k ⊂ E(Fp )/(p + 1)
(11)
`
be the subgroup generated by all mod p Kolyvagin points associated to λ that are a product of f` primes, where
f` is from Equation (9). Note that the subscript of Λ in (11) is `v` +k , and we take the union over all ` thus
obtaining a subgroup Xk,p that need not be `-primary for any `, despite Rp,λ being `-primary. Let
\
Xp =
Xk,p .
k≥0
Let Wk,p be the inverse image of Xk,p under the map πp :
Wk,p = πp−1 (Xk,p ) ⊂ E(K),
and
Wp = πp−1 (Xp ) ⊂ E(K).
Since E(Fp )/(p + 1) is finite, Wk,p and Wp have finite index in E(K); also, by Lemma 5.1, the odd part of this
index divides gcd(p + 1, ap ) .
Remark 5.6. Note that E D (Q) is in the kernel of the trace map, hence in the kernel of πp , so E D (Q) ⊂ Wp .
Thus it is possible that Wp contains torsion, hence Wp in general need not be a Gross-Zagier subgroup as in
Definition 2.3. In a future paper, we intend to give a more refined definition of a sequence of groups Wpa , for
each a ≥ 0, which better accounts for torsion. We would then search for a Gross-Zagier style formula for each
group Wpa for a ≤ f + 1, in order to more closely relate ran (E/Q) to f + 1.
6
Controlling the Reduction Map
The main result of this section is a proof that under certain hypothesis, if a point Q has infinite order and n is
a positive integer, then there are infinitely many primes p such that the image of Q in E(Fp2 )/(p + 1) has order
divisible by n. We prove this using Galois cohomology and by converting a condition on `-divisibility of points
into a Chebotarev condition. We will use this result later to study the maximum index [E(K) : Wp ] that can
occur and prove a generalized Gross-Zagier formula for such Wp .
Let E, K, etc., be as above, and let ` ∈ B(E), where B(E) is the set of primes defined on page 5. Suppose
Q ∈ E(K) has infinite order, and let n be an odd positive integer. Suppose that for each prime ` | n, the set of
cardinalities {# H1 (K(E[`j ])/K, E[`j ]) : j ≥ 1} is bounded. This hypothesis is satisfied if ` ∈ B(E), since then
H1 (K(E[`j ])/K, E[`j ]) = 0 for all j (see [Gro91, pg. 241] and [GJP+ 09, Prop. 5.2]).
Proposition 6.1. Let Q and n be as above. Let S be the set of primes p such that p is inert in K, p splits
completely in K(E[n])/K, and the image of Q in E(Fp2 )/(p + 1)E(Fp2 ) has order divisible by n. Then S has
positive (Dirichlet) density.
Q
Proof. Let m = `ei i with `i the distinct primes thatQdivide n, and ei any positive integers, which we
will fix later in the argument. Fix any i, and let L = K(E[ j6=i `j ]), which is a Galois extension of K. Define
homomorphisms Ψi , f , g, and h as in the following commutative diagram:

E(K(E[m]))/`ei i E(K(E[m])) O
/ H1 (K(E[m]), E[`ei ])
i
= O
f
ψi
H1 (L(E[`ei i ]), E[`ei i ])
O
h
H1 (K(E[`ei i ]), E[`ei i ])
O
g
E(K)/`ei i E(K)

/ H1 (K, E[`ei ])
i
12
W.A. STEIN
The horizontal maps above are induced by the short exact sequence coming from multiplication by `ei i , and
the vertical maps on the right are the restriction maps. The diagram commutes so the order of the image of Q
in E(K(E[m]))/`ei i E(K(E[m])) is the same as the order of Ψi (Q).
By hypothesis and the inflation restriction sequence the cardinality of ker(g) is bounded independently of
i and ei . Also, [L : K] depends only on the set of prime divisors `i of n, not their exponents, so
# ker(h) = # H1 (L(E[`ei i ])/K(E[`ei i ]), E[`ei i ]) = # Hom(Gal(L(E[`ei i ])/K(E[`ei i ])), E[`ei i ])
is also bounded independent of ei , because every homomorphism has image in the fixed subset E[`di ], where d
is the exponent of the group Gal(L/K). Finally, the map f is injective, since
ker(f ) ∼
= H1 (K(E[m])/L(E[`ei i ]), E[`ei i ])
and # Gal(K(E[m])/L(E[`ei i ])) is divisible only by the primes `j for j 6= i and these are all coprime to
b
i
#E[`ei i ] = `2e
i . We conclude that there is an integer b such that # ker(Ψi ) ≤ `i , and this bound holds no
matter how we increase the numbers ei and ej (for all j).
The above proof that ker(Ψi ) is uniformly bounded is completely general. See Remark 6.3 for a sketch of
an alternative proof of this bound in the special case when ` ∈ B(E) for all ` | n, which is the only case we will
use in this paper.
Because ker(Ψi ) is uniformly bounded independent of our choice of ei , for each i, we can choose ei large
ord` (n)
enough so that Ψi (Q) has order divisible by `i i . Then for each i, let di be maximal such that `di i divides Q
in E(K(E[m])). Note
Q that di < ei for each i, since Ψi (Q) 6= 0 and Ψ(Q) is an element of a group that is killed
by `ei i . Since m = `ei i , we have `di i +1 | m, so
!
1
Mi = K E[m], di +1 Q
`i
does not depend on the choice of `di i +1 th root of Q, is a Galois extension of K(E[m]), and [Mi : K(E[m])] is a
nontrivial power of `i . Thus the Mi for all i are linearly disjoint as extensions of K(E[m]).
Let M be the compositum of the fields Mi defined above. Since the Mi are linearly disjoint nontrivial
extensions of K(E[m]), there exists an automorphism σ ∈ Gal(M/Q) such that σ|K(E([m])) is complex
conjugation, and σ|Mi has order divisible by `i for each i. By the Chebotarev density theorem, there is a positive
density of primes p ∈ Z that are unramified in M and have Frobenius the class of σ. Such primes are inert in
K since complex conjugation acts nontrivially on K, split completely in K(E[m])/K since complex conjugation
has order 2, and each prime over p in K(E[m]) does not split completely in any of the extensions Mi /K(E[m])
since [Frobp ]|Mi = σ|Mi has order divisible by `i > 2. Note that this is the only place in the argument where we
use that n is odd.
Let p be any prime as in the previous paragraph. We have
E(Fp2 )/`ei i E(Fp2 ) ∼
= (Z/`ei i Z)2
since pOK splits completely in K(E[m]) and `ei i | m. Also, the Frobenius condition implies that the primes of
Mi over pOK do not have residue class degree 1, so since Mi is generated by any choice of `di1+1 Q, the reduction
Q of Q modulo any prime over pOK is not divisible by `di i +1 in E(Fp2 ). Note that `di i divides Q, because the
prime pOK splits completely in K(E[m])/K and `di i divides Q in K(E[m]), so di is the largest integer such that
`di i divides the image of Q in E(Fp2 ). We conclude that for each i the image of Q in E(Fp2 )/`ei i E(Fp2 ) has order
the same as the order of Ψi (Q).
ord` (n)
By hypothesis, ei ≥ ord`i (n) and Ψi (Q) has order divisible by `i i
for each i, so the image of Q in
E(Fp2 )/mE(Fp2 ) has order divisible by n. For any such p, we also have that the characteristic polynomial of the
class of Frobp in Gal(Q(E[m])/Q) acting on E[m] is x2 − ap x + p (mod m). On the other hand, since [Frobp ]
on E[m] is the class of complex conjugation and complex conjugation acts nontrivially (since m is odd) hence
has characteristic polynomial x2 − 1, we have x2 − ap x + p ≡ x2 − 1 (mod m). Thus m | (p + 1), so the image
of Q in E(Fp2 )/(p + 1)E(Fp2 ) also has order divisible by n, which completes the proof.
√
Remark 6.2. Proposition 6.1 is analogous to the statement that if x, n ∈ Z with gcd(n, x) = 1 and Q(ζn , n x)
is an extension of Q(ζn ) of degree n, then there exist a positive density of primes p such that the multiplicative
order of x modulo p is divisible
√ by n. The proof of this statement resembles the proof of Proposition 6.1, except
we work with the field Q(ζn , n x). The idea of the proof of Proposition 6.1 is well-known to experts who study
questions such as the Lang-Trotter conjecture about reduction of points on elliptic curves.
TOWARD A GENERALIZATION OF THE GROSS-ZAGIER CONJECTURE
13
∞
Remark 6.3. If for every prime ` | n we have ` ∈ B(E), we can alternatively use that K(E[`∞
1 ]) and K(E[`2 ])
are linearly disjoint for distinct odd primes `1 and `2 in B(E) to give a different proof that the maps Ψi have
uniformly bounded kernel in Proposition 6.1. In that case we have that Gal(K(E[n])/K) ≈ GL2 (Z/nZ), so
ker H1 (K, E[n]) → H1 (K(E[n]), E[n]) ∼
= H1 (K(E[n])/K, E[n]) = H1 (GL2 (Z/nZ), (Z/nZ)2 ) = 0,
where the last group is 0 by a standard group cohomology argument (see, e.g., [Ste02, §5.1]). This implies that
∞
the maps Ψi are all injective. The linear disjointness of K(E[`∞
1 ]) and K(E[`2 ]) for the distinct odd primes `1
n
and `2 follows by a Galois theory argument using the structure of GL2 (Z/` Z). We thank R. Greenberg for this
observation.
7
Maximal Index Subgroups Wp
√
As above, we assume that E is an elliptic curve over Q with positive analytic rank and that K = Q( D)
is a quadratic imaginary field that satisfies the Heegner hypothesis and the minimality hypothesis that
ran (E/Q) > ran (E D /Q) ≤ 1.
Recall that for each inert prime p of K we defined a subgroup Xp ⊂ E(Fp )/(p + 1) in Equation (11) of
Section 5. This was a group got by reducing Kolyvagin points associated to all primes ` modulo a choice
of prime over p. In this section, for all ` ∈ B(E) we conditionally compute, in terms of m`,f , the `-primary
part Xp (`) of this subgroup Xp ⊂ E(Fp )/(p + 1). We relate our refinement of Kolyvagin’spconjectures to the
Q
generalized Gross-Zagier formula (5). We also conditionally compute Xp in terms of c · cq · #X(E/K) using
Theorem 4.2. We apply our description of Xp to prove that, up to primes not in B(E), the subgroups Wp with
[E(K) : Wp ] maximal are all Gross-Zagier subgroups of E(K).
Proposition 7.1. Conjecture 4.9 implies that for every ` ∈ B(E),
Xp (`) =
p+1
· πp (`m`,f E(Q)),
`v`
where v` = ord` (p + 1).
Proof. Let Φ be the composite homomorphism
(E(Kλ )/`v` E(Kλ ))
Gal(Kλ /K)
,→ H1 (Kλ , E[`v` ])Gal(Kλ /K) ∼
= H1 (K, E[`v` ]),
and let δ : E(K) → H1 (K, E[`v` ]). We are assuming Conjecture 4.9, so we may apply Proposition 4.11 Part 6
f
(taking into account Lemma 4.5), to see that for all k sufficiently large we have δ(`m`,f E(Q)) = Vk,`
v` . Thus
δ(`m`,f E(Q)) = hΦ([Pλ ]) : λ ∈ Λf`v` +k i.
Gal(K /K)
λ
Let i : E(K) → (E(Kλ )/`v` E(Kλ ))
. For any Q ∈ E(K) we have p+1
`v` · πp (Q) = ϑ(i(Q)) where ϑ is as
in Proposition 5.4. Since δ = Φ ◦ i and Φ is injective, the group Xk,p (`) generated by all ϑ([Pλ ]) is equal to
ϑ(i(`m`,f E(Q))). Since this is true for all sufficiently large k, the proposition follows for Xp .
Theorem 7.5 below generalizes [Kol91b, Thm. E] to arbitrary rank. To prove it we first prove some lemmas
and make a definition.
Lemma 7.2. Suppose A is a nonzero finitely generated free abelian group and ϕ : A → Z/dZ is a surjective
homomorphism. For every nonzero integer c we have [A : ϕ−1 (ϕ(cA))] = gcd(c, d).
Proof. Let B = ϕ−1 (ϕ(cA)). We have ϕ(ker(ϕ)) = 0 ⊂ ϕ(cA), so ker(ϕ) ⊂ B. Since ker(ϕ) ⊂ B, the
isomorphism A/ ker(ϕ) ∼
= Z/dZ induces an isomorphism A/B ∼
= (Z/dZ)/ϕ(B). But ϕ is surjective, so ϕ(B) =
−1
ϕ(ϕ (ϕ(cA))) = ϕ(cA) = cϕ(A) = c(Z/dZ), so A/B ∼
= (Z/dZ)/(c(Z/dZ)) ∼
= Z/ gcd(d, c)Z.
Recall (see page 5) that B(E) is a set of primes that have certain good properties for E. Below, for any
integer n we either let n0 = `ord` (n) be the `-part of n or the maximal divisor of n divisible only by primes in
B(E), depending on whether we are considering the first or second part of the following lemma.
Lemma 7.3. Assume E(Q) has positive rank and let t be a positive integer.
1. If ` ∈ B(E) is such that Xp (`) =
p+1
`v `
· πp (tE(Q)) for all inert primes p, then
max{ord` ([E(K) : Wp ]) : all inert p} = ord` (t).
14
W.A. STEIN
2. If for all ` ∈ B(E) we have Xp (`) =
p+1
`v`
· πp (tE(Q)) for all inert primes p, then
max{[E(K) : Wp ]0 : all inert p} = t0 .
Proof. Let p be any inert prime, and recall that p is a prime of good reduction, since all bad primes split
in K. By Lemma 5.1, the odd part of the image of πp : E(K) → E(Fp )/(p + 1) is a cyclic group Z/nZ for some
integer n. Since πp (E D (Q)) = 0 (see Remark 5.6), we have
πp (tE(Q))0 = πp (tE(Q) + tE D (Q))0 = πp (tE(K))0 ,
so by Proposition 7.6, Wp0 = πp−1 (Xp )0 = πp−1 (πp (tE(K))0 ). Thus Lemma 7.2 implies that [E(K)0 : Wp0 ] is
gcd(t, n)0 . This proves that set of indexes [E(K)0 : Wp0 ] all divide t0 .
We show the maximum equals t0 by proving that there is a positive density of primes p such that the n
above is divisible by t0 . By hypothesis, there is a point P ∈ E(Q) of infinite order. By Proposition 6.1, there
exists a positive density of primes p that are inert in K such that πp (P ) ∈ E(Fp )/(p + 1) has order divisible by
t0 . For such p, the n above is thus divisible by t0 , so gcd(t, n)0 = t0 , which completes the proof.
Let
w` = sup({ord` ([E(K) : Wp ]) : all inert p}) ≤ ∞.
(12)
Lemma 7.4. Suppose ` ∈ B(E), that Conjecture 4.9 is true for E, and assume that p is an inert prime such
that ord` ([E(K) : Wp ]) is maximal in the sense that it equals w` . Then m`,f = ord` ([E(K) : Wp ]).
Proof. We are assuming that Conjecture 4.9 is true, so Proposition 7.1 applies and gives an explicit formula
for Xp (`). Namely, we may take t = m`,f in Lemma 7.3. Also, by Conjecture 4.9 (and Proposition 4.11) we have
E(Q) has rank at least 1. The lemma then follows from Lemma 7.3.
Theorem 7.5. Suppose ` ∈ B(E), that Conjectures 2.2 and 4.9 are true for E, and that p is an inert prime
such that w` = ord` ([E(K) : Wp ]), where w` is as in (12) above. Then Wp satisfies the generalized Gross-Zagier
formula (5) up to a rational factor that is coprime to ` if and only if Conjecture 4.12 is true for `.
Proof. We are assuming Conjecture 4.9, which implies Conjecture 4.1, so we may apply Theorem 4.2, which
has Conjecture 4.1 as a hypothesis. Let bk be as in Theorem 4.2 for our given prime `. Theorem 4.2 implies that
#X(E/K)(`) = #((Z/bf Z)2 ⊕ (Z/bf +1 Z)2 ⊕ (Z/bf +2 Z)2 ⊕ · · · )
= (bf · bf +1 · · · )2
= `2(m`,f −m`,f +1 +m`,f +1 −m`,f +2 +m`,f +2 −··· ) · · ·
= `2(m`,f −m` ) ,
p
so m`,f − m` = ord` ( #X(E/K)(`)).
We will now show that the generalized Gross-Zagier
Q formula (5) holds up to a rational factor that is coprime
to ` if and only if Conjecture 4.12 that m` = ord` (c cq ) is true for `. We will repeatedly use Lemma 7.4 that
m`,f = ord` ([E(K) : Wp ]).
First, suppose that the generalized Gross-Zagier formula (5) holds up to a rational factor that is coprime
to `. Proposition 2.4 combined
(that Xan = #X), implies that this hypothesis means that
Q withpConjecture 2.2 ord` ([E(K) : Wp ]) = ord` c cq · #X(E/K)(`) . Thus:
m`,f = ord` ([E(K) : Wp ])
Y
p
= ord` c
cq · #X(E/K)(`)
Y p
= ord` c
cq + ord` ( #X(E/K)(`))
Y = ord` c
cq + m`,f − m` ,
where in the last equality we use the formula for #X(E/K)(`)
that we derived above using Theorem 4.2.
Q
Subtracting m`,f from both sides shows that
m
=
ord
(c
c
).
`
`
q
Q
Conversely, suppose that m` = ord` (c cq ). From Theorem 4.2 we have
p
m`,f − m` = ord` ( #X(E/K)(`)),
so
Y Y
p
ord` ([E(K) : Wp ]) = m`,f = ord` c
cq + m`,f − m` = ord` c
cq · #X(E/K)(`) .
Proposition 2.4 then implies that Wp satisfies the generalized Gross-Zagier formula up to a rational factor
coprime to `.
TOWARD A GENERALIZATION OF THE GROSS-ZAGIER CONJECTURE
15
For any integer n, let n0 denote the maximal divisor of n that is divisible only by primes in B(E), and for
any abelian group A, let A0 = A ⊗ Z[1/b], where b is the product of the finitely many primes not in B(E). Let
Y
p
T =c·
cq · #X(E/K).
q|N
Proposition 7.6. Conjectures 4.9 and 4.12 together imply that Xp0 = πp (T E(Q))0 .
Proof. Using the calculation in the first paragraph of the proof of Theorem 7.5 along with Conjecture 4.12
combined with Theorem 4.2, shows that for every ` ∈ B(E), we have
m`,f = ord` (T ).
Since the integers T /`m`,f and (p + 1)/`v` , for v` = ord` (p + 1), both act as automorphisms on any `-primary
group,
T
m`,f
·
π
(`
πp (T E(Q))(`) =
E(Q))
(`)
p
`m`,f
= πp (`m`,f E(Q))(`)
p+1
= v · πp (`m`,f E(Q)) = Xp (`),
``
where the last equality uses Proposition 7.1 (which assumes that Conjecture 4.9 is true). We conclude that
Xp0 = π(T E(Q))0 .
Theorem 7.7 is a partial converse to Theorem 7.5.
Theorem 7.7. Assume that E(Q) has positive rank.
p Conjectures 4.9 and 4.12 together imply that the
Q Then
maximum index [E(K)0 : Wp0 ] over all inert p is (c · cq · #X(E/K))0 .
Proof. The conjectures we’re assuming allow us to use Proposition 7.6 and hence take t = T in Lemma 7.3.
This proves the theorem.
Conclusion: By Proposition 2.4, if Wp0 has maximal index in E(K)0 , then imply that we have an equality
L(r) (E, 1)
kωk2
p
=
· Reg(Wp ),
r!
c · |D|
up to powers of primes not in B(E). Thus the Wp0 of maximal index satisfy this generalized Gross-Zagier formula.
Conjecture 7.8. If W ⊂ E(K) is any Gross-Zagier subgroup of index `w` , then there exists an inert prime p
such that Wp0 equals W 0 .
8
Existence of Gross-Zagier Subgroups
Let E, K, etc., be as in Section 1.1, and let
t=c·
Y
cq ·
p
#X(E/K)an .
q|N
In this section we investigate the analogue of the conjectures on pages 311–312 of [GZ86]. In particular, the
existence of any Gross-Zagier subgroup for E(K) combined with the BSD conjecture implies that #E(K)tor | t.
The main theorem of [GZ86] thus led Gross-Zagier to make the following conjecture.
Conjecture 8.1 (Gross-Zagier). If E(K) has rank 1, then the integer t is divisible by #E(Q)tor .
Proposition 8.2. Assume the BSD formula. If there exists any subgroup W of E(K) such that the generalized
Gross-Zagier formula (5) holds for W , then #E(K)tor | t. Note that we do not assume W is torsion free.
Proof. Let W be such a subgroup. Arguing as in the proof of Proposition 2.4, we see that

2
Y
#E(K)2tor · (Reg(W )/ Reg(E/K)) = c2 · 
cq  · Xan = t2 .
q|N
The quotient Reg(W )/ Reg(E/K) is a square integer, so taking square roots of both sides yields the claim.
16
W.A. STEIN
Because of Proposition 8.2, we view the divisibility #E(K)tor | t as a sort of “litmus test” for whether
there could be a generalization of the Gross-Zagier formula in general. First, we observe that the most naive
generalization of Conjecture 8.1 to higher rank is false (!), as the following example shows.
2
3
Example 8.3. Let
Q E be the curve 65a of rank 1 over Q given by y + xy = x − x and let D = −56. Then
#Xan (E/K) = cq = c = 1, so t = 1, but #E(Q)tor = 2. Here E D (Q) has rank 2, so rank(E(K)) = 3, and
the rank hypothesis of Conjecture 8.1 is not satisfied.
Proposition 8.4. Suppose rank(E(Q)) > 0 and that t is a positive integer. Then there exists a Gross-Zagier
subgroup W ⊂ E(K) if and only if #E(K)tor | t.
Proof. Suppose W ⊂ E(K) is a Gross-Zagier subgroup. Then [E(K) : W ] = t. By hypothesis W is torsion
free, so E(K)tor ,→ E(K)/W , so #E(K)tor | #(E(K)/W ) = t.
Conversely, suppose that #E(K)tor | t, and note that by hypothesis E(Q) has positive rank. The group
E(K)/(E D (Q) + E(K)tor ) is thus a finitely generated infinite abelian group, so has subgroups of all index.
In particular, it has a subgroup W 0 such that the quotient by W 0 is cyclic of order t/#E(K)tor . Let W̃ be
the inverse image of W 0 in E(K), so E(K)tor , E D (Q) ⊂ W̃ , and [E(K) : W̃ ] = t/#E(K)tor . Since W̃ is finitely
generated, there exists a torsion free subgroup W ⊂ W̃ such that W ⊕ E(K)tor = W̃ . Then
[E(K) : W ] = #E(K)tor · [E(K) : W̃ ] = #E(K)tor ·
t
= t.
#E(K)tor
Elsewehere in this paper, for technical reasons in order to apply Kolyvagin’s theorems, we made a minimality
hypothesis on ran (E D /Q), and based on extensive numerical data, we conjecture that this is the right hypothesis
to guarantee the existence of Gross-Zagier subgroups W ⊂ E(K).
Conjecture 8.5. If ran (E/Q) > ran (E D /Q) ≤ 1, then #E(K)tor | t. In particular, there exists a Gross-Zagier
subgroup W ⊂ E(K).
We obtain evidence for Conjecture 8.5 using Sage† [S+ 09, Creb, PAR], Cremona’s tables [Crea],
Proposition 8.4, and assuming the Birch and Swinnerton-Dyer conjecture. More precisely, we check that
Conjecture 8.5 is “probably true” for every elliptic curve of rank ≥ 2 and conductor ≤ 130, 000 and the first
three D that satisfy the Heegner hypothesis, except possibly for the triples (E, D, #E(K)tor ) in Table 1 where
the computation of the conjectural order of #X(E/K) took too long.
Table 1: All triples up to conductor 130,000 where we did not yet verify Conjecture 8.5
(8320e1, −191, 2), (9842d1, −223, 3), (9842d1, −255, 3), (9842d1, −447, 3), (74655j1, −251, 3),
(87680a1, −119, 2), (87680a1, −151, 2), (87680b1, −119, 2), (87680b1, −151, 2), (89465a1, −51, 2),
(89465a1, −59, 2), (89465a1, −71, 2), (95545b1, −191, 2), (95545b1, −219, 2), (104585b1, −139, 2),
(104585b1, −179, 2), (104585b1, −191, 2), (114260a1, −231, 2), (114260a1, −239, 2), (114260a1, −431, 2),
(122486a1, −103, 3), (122486a1, −55, 3), (122486a1, −87, 3), (126672r1, −335, 2), (126672r1, −647, 2),
(126672r1, −719, 2), (129940a1, −111, 2), (129940a1, −71, 2), (129940a1, −79, 2)
In our computations, we considered the first three Heegner D, without making the condition ran (E D /Q) ≤ 1.
The conjecture is false without the hypothesis that ran (E D /Q) ≤ 1, as Example 8.3 above shows. Moreover, we
found two further similar examples in which, however, E has rank 2 and E D has rank 3. First, for the curve
E with Cremona label 20672m1, equation y 2 = x3 − 431x − 3444 and D = −127, we have rank(E(Q)) = 2,
rank(E D (Q)) = 3, and #E(K)tor = 2, but t = 1. A second example is E given by 18560c1 and D = −151, in
which again rank(E(Q)) = 2, rank(E D (Q)) = 3, #E(K)tor = 2, but t = 1.
This was a large computation that relies on a range of nontrivial computer code, which we carried out as
follows. First we computed #E(K)tor for each of the 78,420 elliptic curve of conductor
Q ≤130,000 with rank ≥ 2
and the first three Heegner
D.
We
then
determined
whether
#E(K)
divides
c
·
cq . Since we are verifying
tor
Q
that something divides c · cq , there is no loss at all in assuming Manin’s conjecture that c = 1 for the optimal
quotient of X0 (N ). We then computed the Manin constant c for non-optimal curves by finding a shortest isogeny
path from the optimal curve in the isogeny graph of E (there is unfortunately a small possibility of error in
computation of the isogeny graph, due to numerical precision
Q used in the implementation). We found only 37
remaining curves E of rank ≥ 2 such that #E(K)tor - c · cq , and 37 · 3 = 111 corresponding pairs (E, D). It
† Running
on hardware purchased using National Science Foundation Grant No. DMS-0821725.
TOWARD A GENERALIZATION OF THE GROSS-ZAGIER CONJECTURE
17
turns out that all of these curves are optimal hence have c = 1. For each of these pairs (E, D) we attempted
to compute #X(E/K)an using Conjecture 2.2 and some results of [GJP+ 09], and the computation finished
in all but 29 cases. The main difficulty was computing Reg(E/K) in terms of Reg(E/Q) and Reg(E D /Q) by
saturating the sum of E(Q) and E D (Q) in E(K). Computing E D (Q) was sometimes very difficult, since E D
has huge conductor and rank 1, and this sometimes took as long as a day when it completed. For more details,
the reader is urged to read the source code of the Sage command heegner_sha_an in Sage-3.4.1 and later.
References
[ARS06]
A. Agashe, K. A. Ribet, and W. A. Stein, The Manin Constant, JPAM Coates Volume (2006),
http://wstein.org/papers/ars-manin/.
[BCDT01] C. Breuil, B. Conrad, F. Diamond, and R. Taylor, On the modularity of elliptic curves over Q: wild
3-adic exercises, J. Amer. Math. Soc. 14 (2001), no. 4, 843–939 (electronic). MR 2002d:11058
[BFH90]
Daniel Bump, Solomon Friedberg, and Jeffrey Hoffstein, Nonvanishing theorems for L-functions of
modular forms and their derivatives, Invent. Math. 102 (1990), no. 3, 543–618. MR MR1074487
(92a:11058)
[Bir65]
B. J. Birch, Conjectures concerning elliptic curves, Proceedings of Symposia in Pure Mathematics,
VIII, Amer. Math. Soc., Providence, R.I., 1965, pp. 106–112. MR 30 #4759
[Crea]
J. E. Cremona, Elliptic Curves Data, http://www.warwick.ac.uk/~masgaj/ftp/data/.
[Creb]
, mwrank (computer software),
http://www.maths.nott.ac.uk/personal/jec/ftp/progs/.
[GJP+ 09] G. Grigorov, A. Jorza, S. Patrikis, C. Patrascu, and W. Stein, Verification of the Birch and
Swinnerton-Dyer Conjecture for Specific Elliptic Curves, To appear in Mathematics of Computation
(2009).
[Gro91]
B. H. Gross, Kolyvagin’s work on modular elliptic curves, L-functions and arithmetic (Durham, 1989),
Cambridge Univ. Press, Cambridge, 1991, pp. 235–256.
[GZ86]
B. Gross and D. Zagier, Heegner points and derivatives of L-series, Invent. Math. 84 (1986), no. 2,
225–320. MR 87j:11057
[JLS08]
D. Jetchev, K. Lauter, and W. Stein, Explicit heegner points: Kolyvagin’s conjecture and nontrivial
elements in the Shafarevich-Tate group.
[Kol88]
V. A. Kolyvagin, Finiteness of E(Q) and X(E, Q) for a subclass of Weil curves, Izv. Akad. Nauk
SSSR Ser. Mat. 52 (1988), no. 3, 522–540, 670–671. MR 89m:11056
[Kol91a]
V. A. Kolyvagin, On the structure of Selmer groups, Math. Ann. 291 (1991), no. 2, 253–259. MR
93e:11073
[Kol91b]
, On the structure of Shafarevich-Tate groups, Algebraic geometry (Chicago, IL, 1989),
Springer, Berlin, 1991, pp. 94–121.
[McC91]
W. G. McCallum, Kolyvagin’s work on Shafarevich-Tate groups, L-functions and arithmetic
(Durham, 1989), Cambridge Univ. Press, Cambridge, 1991, pp. 295–316. MR 92m:11062
[PAR]
PARI, A computer algebra system designed for fast computations in number theory, http://pari.
math.u-bordeaux.fr/.
[S+ 09]
W. A. Stein et al., Sage Mathematics Software (Version 3.3), The Sage Development Team, 2009,
http://www.sagemath.org.
[Ser72]
J-P. Serre, Propriétés galoisiennes des points d’ordre fini des courbes elliptiques, Invent. Math. 15
(1972), no. 4, 259–331.
[Ste02]
W. A. Stein, There are genus one curves over Q of every odd index, J. Reine Angew. Math. 547
(2002), 139–147. MR 2003c:11059
[Wil95]
A. J. Wiles, Modular elliptic curves and Fermat’s last theorem, Ann. of Math. (2) 141 (1995), no. 3,
443–551.